Blog
Demos, implementation guides, product updates and broader takes on authorization, identity and security. Written for the engineers, architects, security, identity and product leaders shaping how their teams ship and govern access.
Envoy ext_authz: enforcing one authorization policy at the gateway and in the service
Envoy external authorization with the ext_authz filter lets the gateway and the service run checks against one policy set. This guide covers the CheckRequest to Cerbos mapping in CEL, policy outputs as request headers, embedded versus external PDP, bypass paths, caching trade offs and what AuthZEN leaves undefined.
Cerbos PDP v0.55.0: Strict evaluation mode, multiple JWTs, and faster conditions
Cerbos PDP v0.55.0 adds strict evaluation mode, which turns runtime errors in policy conditions into explicit denials instead of silent skips. This release also lets auxData carry multiple named JWTs, folds constant expressions at compile time, and upgrades CEL with 21 new expression functions for networking, regex, and sets.
What's new in Cerbos Hub: audit log exports and a playground that tells you what's wrong
A rundown of the latest Cerbos Hub updates. Audit log exports you can pull into your own tooling for archiving or compliance, playground compiler errors with line and column detail, schema validation on principal and resource fixtures, and egress IPs for GitHub allow lists.
MCP authorization standards: OAuth scopes, AuthZEN, and what's still missing
MCP leans on OAuth 2.1 for authentication, but OAuth scopes cannot answer fine-grained tool authorization. Here is what the standards cover, and what AuthZEN adds.
Mapping business requirements to authorization policy
Learn about how to map your business requirements to RBAC and ABAC policies and adopt Cerbos
What is an MCP gateway? And where authorization actually fits
An MCP gateway routes and manages traffic to MCP servers, but routing is not authorization. Here is what a gateway does, where the authorization gap is, and how to close it.
Mapping business requirements to authorization policy for gaming
Mapping business requirements to authorization policy for gaming, with three worked examples covering player profiles and inventory, virtual asset trading, and moderation actions. Each starts with the business rule and ends with a working Cerbos policy, including derived roles, ABAC conditions, and test cases you can run yourself.
Cerbos security and trust: Data handling, certifications, and deployment isolation
How Cerbos handles your data, where it lives, and what leaves your network. A security and trust overview for CISOs and security teams evaluating Cerbos, covering the stateless PDP, deployment isolation, local field masking, certifications, penetration testing, and the Cerbos Trust Center.
Framework for evaluating authorization providers and solutions
In this guide, we provide a framework for evaluating authorization providers and solutions, tailored to the priorities of enterprise decision-makers. We cover all the key criteria - from integration and performance to admin experience and compliance, and back them with data, industry research, and success metrics.
Best OpenZiti alternatives
Picking an OpenZiti alternative depends on the layer you need to replace. Compare ZTNA and overlay networking, self-hosted identity providers, OAuth2 and OIDC token services, and reverse proxy login gateways, plus where Cerbos handles fine-grained authorization once identity and connectivity are already solved.
Your IdP proves who an AI agent is. DORA expects you to control what it does
Your IdP proves who an AI agent is. DORA also expects you to control what it can do at runtime, which is authorization, not authentication. This guide covers where agents fall into DORA scope, how runtime authorization maps to Article 9 and audit requirements, and the steps to take while agents are still early.
Authentik vs Zitadel for authentication
Compare Authentik and Zitadel for authentication. Decide faster across SSO, MFA, proxy mode, LDAP, multi-tenancy, deployment, operations, and where Cerbos authorization fits.
You have Keycloak. What authorization capabilities do you still need?
Keycloak authentication and Keycloak SSO handle identity well. Authorization at scale is a different problem. Here's where the gap appears and how to fix it.
The kill switch that never got pressed: what the OpenAI–Hugging Face incident tells us about agent authorization
OpenAI's models escaped an eval sandbox and breached Hugging Face. What the incident says about agent kill switches, runtime authorization, and standing access.
Claude Fable 5 and GPT-5.6 Sol authorization refusals
The models that refuse legitimate security work will also run destructive commands without asking. Both are reasons to enforce authorization outside the agent, not in its prompt.
Agent skill for writing authorization policies in VSCode
A practical guide to writing authorization policies in VSCode using GitHub Copilot agent mode and the Cerbos policy skill. Covers install, the gh skill CLI, chat.agentSkillsLocations, file-scoped *.instructions.md, a typical drafting session, and how validation runs in the integrated terminal.
Cerbos PDP v0.54.0: Faster evaluations, lower memory usage, and new store diagnostics
Cerbos PDP v0.54.0 focuses on performance, cutting steady-state memory and raising throughput. This release adds the new cerbos compile-store command for diagnosing policy stores, clearer error reporting across policies and tests, automatic GOMEMLIMIT from cgroup limits, and better runtime observability.
Agent skill for writing authorization policies in Cursor
Cursor's composer makes it a strong fit for authorization policy work. This guide walks through installing the Cerbos policy skill in Cursor, describing access rules in plain English, letting the composer pull schemas and derived roles into context, validating against the real compiler in the integrated terminal, and producing a complete policy bundle.
Recommended content
Mapping business requirements to authorization policy
eBook: Zero Trust for AI, securing MCP servers
Experiment, learn, and prototype with Cerbos Playground
eBook: How to adopt externalized authorization
Framework for evaluating authorization providers and solutions
